Summary : Phishing remains the top route to initial access, with threat actors using social engineering tactics to exploit human behavior and gain entry into compromised environments. Key Point : 🎣 Phishing links or attacks were used in 71% of all security incidents in 2023. 🔒 Most tactics used for…
Summary: The EMorocco group, also known as Evil Morocco, claims to have breached the United States Social Security Administration (SSA) and gained access to a significant amount of personal data. Threat Actor: EMorocco Group (Evil Morocco) Victim: United States Social Security Administration (SSA) A…
EclecticIQ uncovered “Operation FlightNight,” an espionage campaign that used ISO attachments and LNK shortcuts to deliver a modified HackBrowserData stealer targeting Indian government agencies and energy companies. The malware harvested browser caches, docum…
————————————————– Summary: The article discusses the potential risks associated with the SqzrFramework480 .NET DLL, which is suspected of containing industrial espionage malware, highlighting the importance of cautious evaluation and auditing of open source packages….
Genius Security Center analyzed an APT37 campaign that delivers LNK shortcut files inside ZIPs to execute embedded PowerShell, load encrypted shellcode from the LNK, and retrieve a second-stage PowerShell script from Dropbox which allocates memory and executes…
We analyze the actions of two separate Chinese APTs — including Stately Taurus — that targeted ASEAN-affiliated entities through different methods.
The post ASEAN Entities in the Spotlight: Chinese APT Group Targeting appeared first on Unit 42….
Multiple unsolicited calendar (.ics) invites were found to contain embedded URLs that redirect users to a chain of crypto‑phishing sites. Analysis uncovered links to ngsl7.bemobtrcks.com that redirect to receivepayment.fun, bitcoinwallet.xyz and paysitecash.pa…
https://dpmptsp.palopokota.go.id/naila.txt notified by ./unn0rmaL
Cybereason is investigating incidents involving abuse of AnyDesk code signing certificates after AnyDesk reported a production systems compromise and revoked existing certificates. Attackers are purportedly using stolen certificates to sign malware such as Age…
CHAVECLOAK is a sophisticated Windows banking trojan focused on Brazil’s financial sector, capable of credential harvesting, keystroke logging, and C2 communications. It uses multi-stage delivery via deceptive PDFs and MSI installers with persistence and targe…
Oligo Security researchers uncovered ShadowRay, the first known campaign exploiting CVE-2023-48022 to target Ray AI workloads, leading to remote code execution on publicly exposed Ray servers. The widespread impact includes data leakage, credential exposure, a…
Overview This week, the Sonicwall Capture Labs threat research team analyzed a new Golang malware sample. It uses multiple geographic checks and publicly available packages to screenshot the system before installing a root certificate to […]
A novel .NET loader delivered via a phishing email unpacks a polymorphic, obfuscated loader that bypasses AMSI, retrieves an in-memory Agent Tesla payload from hxxps://artemis-rat[.]com using a specific User-Agent and optional HTTP proxies, and executes it via…
A threat actor has emerged, claiming to offer unauthorized access to databases (MySQL) of mobile loan applications operating in Indonesia. It is claimed that there are a total of 11 databases associated with various applications. These databases contain vast amounts of diverse information, including…
Allegedly, a threat actor has emerged claiming to have offered for sale databases purportedly belonging to AllTech and CWU companies. These databases, allegedly compromised, contain sensitive information potentially posing significant risks to the affected organizations and individuals. The attacker…